[ MDVSA-2012:143 ] python-django

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2012:143 http://www.mandriva.com/security/ Package : python-django Date : August 23, 2012 Affected: 2011., Enterprise Server 5.0 Problem Description: Multiple vulnerabilities has been discovered and corrected in...

Wireshark Multiple Vulnerabilities - 01 - (Aug 2012) - Windows

Wireshark is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wireshark:wireshark"; ifdescripti...

FreeBSD Ports: chromium

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2012 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Cross site request forgery (csrf)

Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, does not request user confirmation before continuing a large series of downloads, which allows user-assisted remote attackers to cause a denial of service resource consumption via a craft...

CVE-2012-2847

CVE-2012-2847 affects Google Chrome/Chromium across platforms (Mac/Linux/Windows) where the browser does not prompt for user confirmation before continuing a large series of downloads, enabling user-assisted resource exhaustion leading to a Denial of Service. Public details in connected advisorie...

CVE-2012-2847

Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, does not request user confirmation before continuing a large series of downloads, which allows user-assisted remote attackers to cause a denial of service resource consumption via a craft...

CVE-2012-2847: Undefined Security Weakness

Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, does not request user confirmation before continuing a large series of downloads, which allows user-assisted remote attackers to cause a denial of service resource consumption via a craft...

PT-2012-4300

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 21.0.1180.57 on Mac OS X and Linux, Google Chrome versions prior to 21.0.1180.60 on Windows and Chrome Frame Description The issue allows user-assisted remote attackers to cause a denial of service due to resour...

Atlassian Crowd XML Parsing Denial of Service Vulnerability

Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3 before 2.3.7, and 2.4 before 2.4.1 do not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service resource consumption via unspecified vectors...

Design/Logic Flaw

slssvc.exe in Invensys Wonderware SuiteLink in Invensys InTouch 2012 and Wonderware Application Server 2012 allows remote attackers to cause a denial of service resource consumption via a long Unicode string, a different vulnerability than CVE-2012-3007...

CVE-2012-3847: Undefined Security Weakness

slssvc.exe in Invensys Wonderware SuiteLink in Invensys InTouch 2012 and Wonderware Application Server 2012 allows remote attackers to cause a denial of service resource consumption via a long Unicode string, a different vulnerability than CVE-2012-3007...

PT-2012-5043

Name of the Vulnerable Software and Affected Versions Invensys InTouch 2012 Wonderware Application Server 2012 Description The issue allows remote attackers to cause a denial of service due to resource consumption via a long Unicode string. Recommendations For Invensys InTouch 2012, restrict acce...

php: incomplete CVE-2012-1823 fix - missing filtering of -T and -h

sapi/cgi/cgimain.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script aka php-cgi, does not properly handle query strings that lack an = equals sign character, which allows remote attackers to cause a denial of service resource consumption by placing command-line options...

CVE-2012-2180

The chaining functionality in the Distributed Relational Database Architecture DRDA module in IBM DB2 9.7 before FP6 and 9.8 before FP5 allows remote attackers to cause a denial of service NULL pointer dereference, and resource consumption or daemon crash via a crafted request...

PT-2012-6312

Name of the Vulnerable Software and Affected Versions Openstack Compute Nova versions 2011.3 through 2012.1 Description The issue allows remote authenticated users with certain permissions to cause a denial of service by consuming CPU and hard drive resources via a network request that triggers a...

PT-2012-3807

Name of the Vulnerable Software and Affected Versions Openstack Compute Nova versions 2011.3 through 2012.1 Description The issue allows remote authenticated users with certain permissions to cause a denial of service by consuming CPU and hard drive resources via a network request that triggers a...

Code injection

The Gliffy plugin before 3.7.1 for Atlassian JIRA, and before 4.2 for Atlassian Confluence, does not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of service resource consumption via unspecified vectors...

PT-2012-4373

Name of the Vulnerable Software and Affected Versions Atlassian JIRA TM Software Tempo plugin versions prior to 6.4.3.1 Atlassian JIRA TM Software Tempo plugin versions 6.5.x prior to 6.5.0.2 Atlassian JIRA TM Software Tempo plugin versions 7.x prior to 7.0.3 Description The issue allows remote...

CVE-2012-2927: Undefined Security Weakness

The TM Software Tempo plugin before 6.4.3.1, 6.5.x before 6.5.0.2, and 7.x before 7.0.3 for Atlassian JIRA does not properly restrict the capabilities of third-party XML parsers, which allows remote authenticated users to cause a denial of service resource consumption via unspecified vectors...

Design/Logic Flaw

sapi/cgi/cgimain.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script aka php-cgi, does not properly handle query strings that lack an = equals sign character, which allows remote attackers to cause a denial of service resource consumption by placing command-line options...